Add PKGID (SIGMD5) support to RPM cataloger

**What would you like to be added**:

Expose the RPM `PKGID` (`RPMTAG_SIGMD5`, tag 261) in syft's RPM package metadata output.

**Why is this needed**:

`PKGID` is the MD5 digest of the combined RPM header and payload contents. It is the package-level content checksum used by RPM to uniquely identify a specific package build.

Syft already exposes RPM signing signatures (`RPMTAG_PGP` / `RPMTAG_RSAHEADER`) via the `Signatures` field, but these are absent for unsigned packages — such as internally built or legacy RPMs. In those cases, `PKGID` is the only available identifier for integrity verification.

**Additional context**:

The data is already available in `github.com/anchore/go-rpmdb`.

Start with Syft's RPM cataloger and inspect the RPM metadata exposed by github.com/anchore/go-rpmdb, including RPMTAG_SIGMD5 (tag 261). Done means the RPM package metadata output includes PKGID for packages, including unsigned RPMs.

Written by the indexing model from the issue text.